Loading story…
A security audit of Inspektor Gadget, the open source eBPF-based observability toolkit for Kubernetes clusters and Linux hosts, identified three security-impacting issues and six hardening recommendations. The review was conducted in early 2026 by Shielder for OSTIF with support from the Cloud Native Computing Foundation, using threat modeling, manual and AI-assisted code review, dynamic testing, and static analysis across the project’s core components.
The findings included a medium-severity command injection flaw in the gadget build process, a medium-severity denial-of-service condition caused by event flooding of a shared kernel ring buffer, and a low-severity issue involving unsanitized ANSI escape sequences in terminal output. Project maintainers patched all three issues, including a fix for the command injection in Inspektor Gadget v0.51.1, added dropped-event detection for the flooding issue, and sanitized terminal output; auditors also urged further hardening such as enabling TLS by default for ig daemon, pinning CI/CD dependencies by hash, reducing Kubernetes permissions, and addressing tracing bypass techniques involving openat2, io_uring, IPv6, jumbo frames, and static linking.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
OSTIF announced the completed audit results for Inspektor Gadget, stating that three security-impacting findings had been identified and patched. The announcement also noted that the eBPF validator and WASM runtime were out of scope for the assessment.
Project maintainers remediated all three vulnerabilities identified in the audit. The command injection flaw was fixed in Inspektor Gadget v0.51.1, dropped-event detection was added for the event-flooding issue, and terminal output was sanitized to address ANSI escape sequence abuse.
The audit found three security-impacting issues, including command injection in the gadget build process, a denial-of-service condition from shared ring-buffer event flooding, and unsanitized ANSI escape sequences in terminal output. It also documented six hardening recommendations and multiple tracing bypass techniques.
Shielder conducted a security audit of Inspektor Gadget for OSTIF with support from CNCF in early 2026, assessing core components through threat modeling, code review, dynamic testing, and static analysis.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026
Belgium's Centre for Cybersecurity warned organizations to patch **Kubernetes ingress-nginx** immediately after disclosure of an arbitrary code execution issue affecting the widely used NGINX Ingress Controller. The flaw, tracked as **`CVE-2026-3288`**, is a high-severity configuration injection vulnerability that lets an authenticated user with permission to create or modify Ingress resources inject arbitrary **nginx** directives through a crafted double quote in the Ingress path field, potentially leading to remote code execution and exposure of secrets accessible to the controller. Sysdig reported that **`CVE-2026-3288`** was fixed on March 9, 2026 and stemmed from an incomplete remediation of the related **`CVE-2026-24512`**. According to the company, sanitization had been added to one code path but omitted from another, while built-in validation relied on an incomplete blocklist that attackers could bypass with payloads such as `return` directives. Affected releases include ingress-nginx versions before **`v1.13.8`**, **`v1.14.4`**, and **`v1.15.0`**; defenders were urged to upgrade, tighten **RBAC** permissions for Ingress changes, and monitor Kubernetes audit logs for signs of exploitation.
Jun 29, 2026
Kubernetes maintainers disclosed five critical vulnerabilities in **ingress-nginx**, including **`CVE-2025-1974`** with a **CVSS 9.8** rating, warning that attackers on the Pod network could abuse configuration injection in the Validating Admission Controller to take over clusters without credentials. The flaws also affect how ingress-nginx builds **NGINX** configuration from crafted Ingress objects, potentially exposing Secrets available to the controller and leading to full cluster compromise. Patched releases **`ingress-nginx v1.12.1`** and **`v1.11.5`** were issued, and operators were urged to upgrade immediately or temporarily disable the Validating Admission Controller until patching is complete. The disclosure adds to broader concerns about Kubernetes networking and multi-tenant isolation, highlighted by **`CVE-2021-25740`**, an unpatchable issue that lets users with permission to modify **Endpoint** or **EndpointSlice** objects redirect service traffic to unauthorized IP addresses. In shared ingress-controller or load-balancer deployments, that behavior can allow one tenant to steer traffic into another tenant’s workloads and bypass intended network boundaries. Security researchers and vendors said the combined risk is highest in clusters that rely on shared ingress infrastructure with broad Secret access, and recommended tightening EndpointSlice permissions, avoiding shared ingress designs in sensitive environments, and evaluating the **Gateway API** as a safer architecture.
Jun 29, 2026